CODE OF PRACTICE FOR PAYMENT CARD SCHEME OPERATORS Background Under the Clearing and Settlement Systems Ordinance, which came into force on 4 November 2004, the Hong Kong Monetary Authority (HKMA) has the power to designate and oversee clearing and settlement systems that are material to the monetary or financial stability of Hong Kong or to the functioning of Hong Kong as an international financial centre. The objective is to promote the general safety and efficiency of designated clearing and settlement systems. Five large value clearing and settlement systems have been designated. As the overseer, the HKMA monitors the compliance of designated payment systems with the safety and efficiency requirements stipulated in the Ordinance. Currently, payment card schemes in Hong Kong handle large volumes of transactions of relatively low value and, compared with the designated payment systems, carry little, if any, systemic risk. The HKMA therefore has not designated these schemes under the Ordinance. Instead, the HKMA encourages the payment card industry to adopt a self-regulatory approach under which the payment card scheme operators would draw up a code of practice and monitor their compliance with the code, with the HKMA monitoring the overall implementation of such self-regulatory approach. Purpose This Code of Practice (“Code”) is intended to form part of the self-regulation of retail payment services in Hong Kong. It specifies general principles for the payment card scheme operators 1 to observe in order to promote the general safety and efficiency of payment cards in Hong Kong and to foster public confidence in them. Classification This is a non-statutory Code drawn up by the payment card scheme operators in Hong Kong. New payment card scheme operators entering the Hong Kong market should also adhere to the general principles in this Code. Application To the payment card scheme operators in Hong Kong. This Code applies only to their operations in Hong Kong and is not intended to have extra-territorial effect. 1 “Payment card scheme operators” means, for the purposes of this Code, multi-purpose payment card schemes which provide credit and/or debit function through a payment network for making payment of goods or services. It excludes multi-purpose stored-value cards, which are dealt with separately in the Code of Practice for Multi-purpose Stored Value Card Operation issued in August 2005, which is a non-statutory code issued by the system operator of the Octopus card to advance the card’s general safety and efficiency and to foster public confidence in the system. Structure INTRODUCTION 1. Status of the Code of Practice for Payment Card Scheme Operators 2. Objectives 3. Enquiries SAFETY 4. Legal Basis of the System 5. Rules and Procedures 6. Operational Reliability and Business Continuity 7. Security 8. Governance Arrangements 9. Data Security and Integrity 10. Financial Requirement OPERATIONAL EFFICIENCY 11. Operational Efficiency TRANSPARENCY 12. Participation Criteria 13. Transparency and Competition MONITORING REQUIREMENTS 14. Prudential Supervision 15. Data Collection 16. Incident Reporting 17. Compliance INTRODUCTION 1. Status of the Code of Practice for Payment Card Scheme Operators 1.1. This Code of Practice (“Code”) has been drawn up by the eight payment card scheme operators that have payment card operations in Hong Kong currently. They are American Express International, Inc., China UnionPay Co. Ltd., Diners Club International (HK) Ltd, JCB International (Asia) Ltd., MasterCard International Inc., Visa International Service Association, Hong Kong Representative Office, EPS Company (Hong Kong) Limited and Joint Electronic Teller Services Ltd. (JETCO). The development of the Code was overseen and has been endorsed by the Hong Kong Monetary Authority (HKMA). A payment card scheme generally involves either of the following: (a) three operational parties, namely the payment card scheme operator, which is both a card issuer and merchant acquirer (although sometimes third parties are contracted or franchised to perform these activities), merchants and cardholders – these schemes are referred to as “three-party schemes”; or (b) where the scheme is operated on a platform provided by the payment card scheme operator 2, four operational parties, namely card issuers, merchant acquirers (although sometimes payment card scheme operators may act as the merchant acquirers), merchants and cardholders– these schemes are referred to as “four-party schemes”. 1.2. This Code is not legally binding and does not confer legal rights on, or give rise to legal rights or liabilities against, any payment card scheme operator, the HKMA or any other person or legal entity. Nevertheless, with the objective of promoting the general safety and efficiency of payment cards operations in Hong Kong and to foster public confidence in such operations, by signing this Code each payment card scheme operator declares its intention to make reasonable efforts to comply with it. Each payment card scheme operator will monitor such compliance and will report on its compliance status to the HKMA. The HKMA will monitor the overall implementation of the self-compliance with this Code and will work with the payment card scheme operators to follow-up on non-compliance issues, if any. 1.3 Where applicable, the principles in this Code apply to the daily operations of payment card scheme operators in Hong Kong, notwithstanding that each payment card scheme operator has its own mode of operation. The principles in this Code also apply to each payment card scheme operator’s overall relationship with, in the case of an operator of a three-party scheme, its cardholders and merchants in Hong Kong and, in the case of an operator of a four-party schemes, its card issuers and merchant acquirers in Hong 2 The payment card scheme operator provides a platform consisting of two parts. It (1) licenses or authorizes card issuers to issue payment cards using its acceptance mark and/or licenses or authorizes merchant acquirers to acquire transactions effected with such cards; and (2) provides clearing and/or settlement services for such card issuers and merchant acquirers. Kong. 1.4. The provisions of this Code are supplementary to and do not supplant any relevant legislation, codes, guidelines or rules applicable to institutions authorized under the Banking Ordinance or to systems designated under the Clearing and Settlement Systems Ordinance. 1.5. The Code is subject to review and revision from time to time by the payment card scheme operators with the endorsement of the HKMA. 2. Objectives 2.1. This Code is intended to promote the general safety and efficiency of payment card operations in Hong Kong and to foster public confidence in payment card operations. 3. Enquiries 3.1. Due to the differences in the ownership or membership structure, phases of development, business model and operation mode of each payment card scheme, each payment card scheme operator’s interpretation of this Code is applicable only to itself and does not necessarily represent or reflect the interpretation of any one or more or all of the other payment card scheme operators. 3.2. Enquiries about this Code should be addressed to the relevant payment card scheme operators. Their contact information can be obtained from their Hong Kong corporate or their head offices websites. 3.3 This Code can be viewed or downloaded from the website of each of the payment card scheme operators, if any, and of the HKMA. SAFETY 4. Legal Basis of the Operation 4.1. Each payment card scheme operator should have a sound legal basis for its payment card operations in Hong Kong, together with appropriate rules and procedures. 4.2 Appropriate processes should be in place to ensure that rules and procedures as well as the contractual relationships with its relevant parties (e.g. merchant acquirers and card issuers, merchants and cardholders, where applicable) should be valid and enforceable. Where applicable, this should include clear rules and procedures to regulate authorization, clearing and settlement for both domestic and cross-border transactions. 5. Rules and Procedures 5.1 Each payment card scheme operator of a four-party scheme should have rules and procedures of the scheme that enable its merchant acquirers and card issuers to obtain sufficient information regarding their respective rights and obligations associated with their participation in its payment card scheme. Such rights and obligations must be clearly defined and disclosed to its merchant acquirers and card issuers. Rules and procedures of the scheme should be complete, up-to-date and readily available to all its merchant acquirers and card issuers; and they should be duly informed of any relevant changes in the rules and procedures. 5.2 Each payment card scheme operator of a three-party scheme should have, and each payment card scheme operator of a four-party scheme should encourage its card issuers and/or its merchant acquirers (as applicable) to have, rules and procedures covering the following areas: (a) the liabilities of cardholders for any loss arising from unauthorized use of the card; and (b) the arrangements to handle charge-backs, if applicable, and disputes over cardholders’ liability with respect to unauthorized transactions. 5.3 Each payment card scheme operator of a three-party scheme should have, and each payment card scheme operator of a four-party scheme should have and encourage its merchant acquirers and card issuers to have, clear procedures for the processes of setting fees and charges. 6. Operational Reliability and Business Continuity 6.1. Each payment card scheme operator should have sound and prudent management, administrative, accounting and control procedures managing the financial and non-financial risks to which it reasonably considers it may be exposed. 6.2. Each payment card scheme operator should conduct risk analysis on new payment card products. In addition, where it reasonably believes that there has been a change of relevant circumstances, each payment card scheme operator should perform a review on the risk profile of existing products to assess risks relating to product security and continuity.